Privacy Policy

1. Information we collect

• Account information: name, email address, a hashed password, and the role assigned to your account (learner or admin).
• Marketing preferences: whether you opted in to product tips and onboarding emails (unchecked by default at signup).
• Contact and consultation form submissions: your name, email address, phone number (if you provide one), and the message you send us when you contact us through a form on tacticaladapt.com or elsewhere.
• Attribution: first-touch UTM parameters, referrer, and referral codes captured at signup to measure marketing channels (not sold to third parties).
• Subscription information: tier, status, and billing identifiers returned to us by Stripe (e.g. customer and subscription IDs, period end). We do not store payment-card numbers.
• Session data: session identifiers, creation and last-used timestamps, and the IP address associated with login attempts. We also keep an audit log of failed login attempts to detect abuse.
• Learning data: lessons completed, quiz attempts and scores, certificates issued, notes you write, and your current resume position.
• AI tutor prompts and responses: the question text you submit to the AI tutor, the response generated by the model, the course and lesson context, the model name, and timestamps. See section 3.
• Operational logs: standard server logs (request paths, status codes, error messages) used to operate and secure the service.
• Product analytics & session replay: we use Microsoft Clarity to understand how the product is used. Clarity collects usage data such as pages viewed, clicks, scrolling, mouse movement, device and browser information, and approximate location, and may record a replay of your interactions with the interface. This helps us find usability problems and improve the service. Clarity is loaded only on our production site.

2. How we use information

• To provide, maintain, and improve the service.
• To authenticate you, secure your account, detect and prevent abuse (including automated activity, credential stuffing, and AI-tutor misuse), and enforce our Terms.
• To process payments and manage subscriptions via Stripe, and to send transactional emails (e.g. verification, password reset, billing notices) via SendGrid.
• To send service updates and, if you opt in, periodic learning digests and product tip emails. Marketing email is separate from the digest opt-in and is off by default. You can change either preference in Settings at any time.
• To follow up on inquiries and for marketing purposes: when you submit a contact or consultation form, we add your information to our CRM and may follow up with you about TAG’s services, including by phone, email, or text if you provided a phone number. This is a legitimate-interest use of your contact information, not something you separately opt in to — but you can opt out of further marketing contact at any time (see Section 7).

3. AI tutor data — what is logged

When you use the AI tutor we send your question, together with the relevant course material, to a third-party LLM provider. We store the question text, the response, the model used, character counts, and the timestamp in our database, associated with your account. We use this data to:

• Operate and debug the AI tutor.
• Detect and investigate abuse and enforce our Terms.
• Improve safety prompts and refine the experience. We do not sell prompt content, and we do not use your prompts to train third-party models beyond what is necessary to produce a response.

Administrators of the Scaffold platform can review your prompt activity for safety and abuse-monitoring purposes. Do not include sensitive personal information, credentials, or confidential third-party data in your prompts.

4. Sharing

We share information only with the third parties needed to operate the service:

• Stripe — processes payments and stores card data on our behalf.
• SendGrid — sends transactional and notification emails.
• HubSpot — our CRM, used to track, follow up on, and market to inquiries submitted through our contact and consultation forms.
• Microsoft Clarity — provides product analytics, heatmaps, and session replay so we can understand usage and improve the service.
• LLM provider(s) — receives the question text and course context required to generate a response.
• Cloud infrastructure providers — host the application and database (e.g. compute, object storage, managed database).

We do not sell your personal information. We may disclose information when required by law, to enforce our Terms, or to protect the rights, safety, or property of Scaffold, our users, or others.

5. Retention

We keep account, learning, and AI-tutor data for as long as your account is active and for a reasonable period afterward to comply with legal obligations, resolve disputes, and prevent abuse. Login-attempt records and prompt logs are retained for at least twelve months for security purposes. You can request deletion of your account through the support widget; some data may persist in backups for a limited additional period.

6. Security

We use industry-standard safeguards to protect your information, including TLS in transit, hashed passwords, scoped database credentials, and access controls for administrator tools. No method of transmission or storage is perfectly secure.

7. Your choices and rights

You can update your name and email from your account settings, change your password, and end active sessions. Email preferences (weekly digest and marketing tips) live under Settings. Depending on your location, you may have additional rights (access, correction, deletion, portability, objection, and, where applicable, the right to opt out of the sale or sharing of your personal information — we do not sell or share it for cross-context behavioral advertising). Contact us through the support widget or /contact to exercise these rights.

Opting out of marketing contact. If you reach us through a contact or consultation form, we may follow up about our services as described in Section 2. You can opt out of further marketing contact at any time — by using the unsubscribe link in any marketing email, replying to any email from us and asking to stop, or telling us directly through the support widget or /contact. We will honor opt-out requests within a reasonable time. Opting out of marketing does not affect transactional communication needed to respond to an inquiry already in progress.

8. Children

Scaffold is not directed to children under 13. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete it.

9. International users

Your information may be processed in countries other than your own, including the United States. We rely on standard contractual safeguards where required.

10. Changes

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date. Material changes will be communicated in-product or by email.

11. Contact

Questions about this policy can be sent through the in-product support widget or the /support page.